Simple-git vulnerabilities
We track 5 vulnerabilities in Simple-git products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on April 25, 2026.
Latest Simple-git vulnerabilities
- 9.8 Critical severity
simple-git: Improper Control of Generation of Code
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form
- 9.8 Critical severity
simple-git: Improper Control of Generation of Code
Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](
- 9.8 Critical severity
simple-git: Improper Neutralization of Special Elements used in an OS Command
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.
- 9.8 Critical severity
simple-git: Improper Neutralization of Argument Delimiters in a Command
The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-
- 9.8 Critical severity
simple-git: Improper Neutralization of Argument Delimiters in a Command
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git opt